Edinei

A security issue exists in Portabilis i-Educar. The problem relates to insecure inherited permissions within the User Type Handler component, specifically in the file `app/Http/Controllers/AccessLevelController.php`. This manipulation can be initiated remotely. The details of the exploit have been publicly disclosed.

A cross site scripting issue exists in Portabilis i-Educar up to version 2.10. The issue is related to the manipulation of the `Tipos de Usuário/Descrição` argument within an unknown function of the `/usuarios/tipos/` file. This can be initiated remotely.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A weakness exists in Portabilis i-Educar up to version 2.10 related to cross site scripting. The issue is located in an unknown functionality of the file `/intranet/educar usuario cad.php` within the Editar usuário Page component. Manipulation of the arguments `email`, `data inicial`, and `data expiracao` can trigger the issue. The attack can be initiated remotely, and the exploit has been made publicly available. Recommendations: Versions prior to 2.11: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A flaw has been found in Portabilis i-Educar that allows for improper access controls. This issue affects an unknown part of the file `/enturmacao-em-lote/`. The attack is possible to be carried out remotely. The exploit has been published.

A vulnerability exists in Portabilis i-Educar that allows for improper access controls. This issue affects unknown code within the `/cancelar-enturmacao-em-lote/` API endpoint and can be exploited remotely. The exploit for this issue has been publicly disclosed.

A vulnerability exists in Portabilis i-Educar up to version 2.10. The issue affects an unknown function within the `/exportacao-para-o-seb` file and results in improper access controls due to manipulation. The attack can be carried out remotely.